A logistics enterprise runs 800 EC2 instances and 200 ECR images across prod and dev, facing audit pressure to continuously scan OS and container vulnerabilities and auto-patch missing updates within maintenance windows without manual SSH. Which automated scanning and patching design closes findings end-to-end?
Select an answer to reveal the explanation.
Short Explanation
You've got too many servers to babysit manually, so let Inspector act like your nonstop security lookout for EC2 and ECR. You'll then let Patch Manager handle the fixes automatically inside your maintenance windows, so you're audit-ready without touching SSH.
Full Explanation
The correct approach works because Inspector continuously scans EC2 instances for OS and software vulnerabilities and ECR images for package issues, while Patch Manager defines patch baselines and maintenance windows to install missing updates via SSM without interactive access. Config rules with Security Hub patching fails by concept because Config evaluates configuration compliance, not CVE-level vulnerability scanning, and Security Hub orchestrates findings rather than natively executing OS patches. GuardDuty with State Manager fails by concept because GuardDuty detects malicious behavior and threats, not comprehensive CVE inventories, and State Manager enforces desired state rather than patch-baseline workflows. CloudWatch agent with Automation patching ECR fails by concept because CloudWatch collects metrics and logs, not vulnerability data, and Automation cannot patch immutable container image layers directly. Exam caveat: match Inspector to vulnerabilities, Patch Manager to OS updates, and GuardDuty to threats. Practical check: confirm Inspector coverage, baseline approvals, and maintenance window success rates with reboot compliance.